Portál AbcLinuxu, 25. dubna 2024 19:39
Aug 25 22:28:24 server named[32416]: validating @0xb7a9eaf8: cz SOA: bad cache hit (cz/DNSKEY)
Aug 25 22:28:24 server named[32416]: broken trust chain resolving 'idnes.cz/DS/IN': 10.109.255.254#53
Aug 25 22:28:24 server named[32416]: no valid DS resolving 'g.idnes.cz/A/IN': 10.109.255.254#53
Aug 25 22:28:24 server named[32416]: validating @0xb7a74f98: g.idnes.cz A: bad cache hit (idnes.cz/DS)
Aug 25 22:28:24 server named[32416]: broken trust chain resolving 'g.idnes.cz/A/IN': 10.109.183.1#53
Ještě do včerejšího odpoledne to fungovalo, takže se to stalo z ničeho nic.
Když nastavím na serveru v /etc/resolv.conf jeden jediný nameserver - 127.0.0.1, aby se ptal server sám sebe, tak nepřeloží taky nic krom domén, kterých je řadičem. Samozřejmě mám nastavený forward, takže se dotazuje dvou dalších DNS serverů providera (10.109.183.1 s 10.109.255.254 - viz log).
Netušíte, v čem může být háček ? Ještě přikládám část configu (jen tu, která se v poslední době nějak měnila).
options {
directory "/var/cache/bind";
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
forwarders {
10.109.183.1;
10.109.255.254;
};
auth-nxdomain no; # conform to RFC1035
listen-on { any; };
also-notify { 83.167.232.39; 10.0.10.3; };
allow-query { any; }; // chceme, aby se mohlo dotazovat na server odkudkoli
dnssec-enable yes;
dnssec-validation yes;
};
Ještě mi napadlo, nemůže to mít souvislost s tím, že CZ.NIC úspěšně přešel na NSEC3 ?
Díky.
Řešení dotazu:
// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local
include "/etc/bind/dnssec.czkey"; // ten je v dalsim odstavci
include "/etc/bind/named.conf.options";
include "/etc/bind/rndc.key";
include "/etc/bind/slave.key";
acl "parani" {
127.0.0.1;
10.0.10.1/8;
};
server 10.0.10.3 {
keys {
TRANSFER;
};
};
controls {
inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { "rndc-key"; };
};
// prime the server with knowledge of the root servers
zone "." {
type hint;
file "/etc/bind/db.root";
};
// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912
zone "localhost" {
type master;
file "/etc/bind/db.local";
................
trusted-keys {
"cz." 257 3 5
"AwEAAdo9fGLzCyxz1yTlsHCT7JpHrg0q/yOlvDNg39n/gAUzg6H/5X9p
jW6mpecJuZirIcPcRw5E7E8uR8g2ztH4uztoc/7ss01s3rTnEgXfilbd
psEdXEuxIfhq+w6zL6PvCcE3qRSzsrc2//x/SXjWp8yeT4YY3W3kvB4Z
g5ld0a8bAHBYo4ZY9x7a3qnqOhqunXSG8EfRPD9koUMgWCjdnFNR89L1
5Bkzh+q1J7phTHIY5akKf3YnIB/5BnKmGBC7DimK4uSBLiBA3DLxHnvL
ffMT5XtKKHuQ/uZ4IxHWqR2cpHz/6e2WaQvOVILwd0gk9lTCildBGjC7
eNxOMnitkuM=" ;
};
include "/etc/bind/dnssec.czkey";
A už to jede no
managed-keys {
"." initial-key 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD
X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS
Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0=";
};
(A trusted-keys zadne)
* nebo pro BIND 9.6:
trusted-keys {
"." 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD
X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS
Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0=";
};
Tiskni Sdílej:
ISSN 1214-1267, (c) 1999-2007 Stickfish s.r.o.